fix(database): make root password create-only for SecretBackendConnection (fixes #38)

[clain23]

Problem (fixes #38)

vault_database_secret_backend_connection re-sends the root password on every reconcile, clobbering a rotate-root'd password (28P01 / broken dynamic creds).

Root cause: Vault's database/config/<name> read API never returns the password, so the refreshed Terraform state has no password. Upjet then diffs the desired config (with the password resolved from passwordSecretRef) against state (no password) → a perpetual non-empty diff on <engine>.0.password → databaseSecretBackendConnectionUpdate's d.HasChange(passwordKey) is true every reconcile → the password is PUT back to database/config, overwriting whatever rotate-root last set.

This makes the resource fundamentally incompatible with rotate-root, which is the documented way to take ownership of the root credential after creation.

Fix

A TerraformCustomDiff that drops every engine <engine>.0.password attribute from the Update diff (keyed on a non-empty Terraform state ID) while leaving the Create diff intact. The password is sent once at creation and never re-sent on reconcile, so a rotated password survives.

This is the Crossplane-native equivalent of the well-known Terraform workaround lifecycle.ignore_changes = [postgresql[0].password].

• Pure Upjet config (config/database/config.go + wiring in config/provider.go) — no schema/CRD change, no make generate diff.
• Create path unchanged (password still required + sent for new connections).
• Engine list sourced from GetConnectionDetailsMapping() (all 17 engines with a root password); a unit test guards against drift.

Test

config/database/config_test.go: Create keeps the password; Update drops it for all engines; nil/Destroy diffs untouched; engine-list completeness.

Validated in production (Crossplane v2) across two clusters: with this change the connections reconcile under full managementPolicies without ever re-writing database/config, and a rotate-root'd password survives provider cold-starts.

[Upbound-CLA]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}